aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52

Analysis

max time kernel
129s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 23:43

Target

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
Size

194KB
MD5

1de1c907f9ca6a9e800e1ef9213a56e9
SHA1

0792859d5a37d5abd0cf052160e820fb5c82f7d5
SHA256

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52
SHA512

b4a18fafea3b7680db1dd023e059c991b6ad2e69e4d21f18bda10b2acd32744b94becaeb8cc6d0022a247858c6b34b689b77796cbf1e3ebb4bb5beddb1049601
SSDEEP

3072:LBq/nm9wMK4q+GIhb9wlzcpI+HnNQkBa0WEcXxTtCCxv0kjlgu9O:MnWhVthbalzAI+HqiaEcXZRXD

Score

8^/10

spyware stealer upx

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/2440-133-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4900-136-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/2440-138-0x0000000000400000-0x0000000000471000-memory.dmp	upx
behavioral2/memory/4828-141-0x0000000000400000-0x0000000000471000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe

description	pid	process	target process
PID 2440 wrote to memory of 4900	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 2440 wrote to memory of 4900	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 2440 wrote to memory of 4900	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 2440 wrote to memory of 4828	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 2440 wrote to memory of 4828	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
PID 2440 wrote to memory of 4828	2440	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe	aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
"C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe startC:\Users\Admin\AppData\Roaming\Microsoft\conhost.exe%C:\Users\Admin\AppData\Roaming\Microsoft
2⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe
C:\Users\Admin\AppData\Local\Temp\aa0f8c325ee6381888c4c0740ab420245f64442ff5741728d5cce86128df5f52.exe startC:\Users\Admin\AppData\Roaming\dwm.exe%C:\Users\Admin\AppData\Roaming
2⤵
PID:4828

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

memory/2440-132-0x000000000063F000-0x000000000065E000-memory.dmp

Filesize
124KB

Download
memory/2440-133-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2440-134-0x000000000063F000-0x000000000065E000-memory.dmp

Filesize
124KB

Download
memory/2440-138-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2440-139-0x000000000063F000-0x000000000065E000-memory.dmp

Filesize
124KB

Download
memory/4828-140-0x0000000000000000-mapping.dmp

Download
memory/4828-141-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4828-142-0x0000000000503000-0x0000000000522000-memory.dmp

Filesize
124KB

Download
memory/4900-135-0x0000000000000000-mapping.dmp

Download
memory/4900-136-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4900-137-0x0000000000663000-0x0000000000682000-memory.dmp

Filesize
124KB

Download